NXT :: descendant of Bitcoin - Updated Information - page 1018.

mezzovide

member

Activity: 101

Merit: 10

Quote from: Emule on February 07, 2014, 12:51:10 PM

Quote from: Come-from-Beyond on February 07, 2014, 10:59:26 AM

Critical bug disclosure

Few days ago the guy who found a vulnerability in Blockchain.Info and picked the secret phrase of Nxt genesis account found a security flaw in NRS cryptographic algorithm. The flaw allowed to replay transactions that would lead to double-triple-etc amounts sent. In fact, by finding this flaw he conducted an audit of Crypto class and won the bounty that we collected specially for such a case.

I can't explain details of the flaw, coz it's out of my area of expertise. U can contact him directly via nextcoin.org forum.

The flaw has been fixed and all who updated to 0.6.0+ are safe now. Users of older versions are safe too as long as they are connected to nodes with 0.6.0+.

PS: The community should collect 10 BTC again coz we still need to do the audit of the code.

so next is broken al ready and they have to paid ransom to a guy for stopping attacks. Why r people still buying this broken piece of shitcoin

and main dev don't know nothing about if you have to ask the attacker self.

0.000003

punkrock

hero member

Activity: 808

Merit: 1011

@Emule: So, the priest did bad things with you, when you were young? I'm so sorry.

msin

legendary

Activity: 1470

Merit: 1004

Quote from: Emule on February 07, 2014, 12:51:10 PM

Quote from: Come-from-Beyond on February 07, 2014, 10:59:26 AM

Critical bug disclosure

Few days ago the guy who found a vulnerability in Blockchain.Info and picked the secret phrase of Nxt genesis account found a security flaw in NRS cryptographic algorithm. The flaw allowed to replay transactions that would lead to double-triple-etc amounts sent. In fact, by finding this flaw he conducted an audit of Crypto class and won the bounty that we collected specially for such a case.

I can't explain details of the flaw, coz it's out of my area of expertise. U can contact him directly via nextcoin.org forum.

The flaw has been fixed and all who updated to 0.6.0+ are safe now. Users of older versions are safe too as long as they are connected to nodes with 0.6.0+.

PS: The community should collect 10 BTC again coz we still need to do the audit of the code.

so next is broken al ready and they have to paid ransom to a guy for stopping attacks. Why r people still buying this broken piece of shitcoin

and main dev don't know nothing about if you have to ask the attacker self.

0.000003

Emule, please PM me is you are selling your Nxt. I'm buying.

ChuckOne

sr. member

Activity: 364

Merit: 250

☕ NXT-4BTE-8Y4K-CDS2-6TB82

Quote from: Emule on February 07, 2014, 12:51:10 PM

Quote from: Come-from-Beyond on February 07, 2014, 10:59:26 AM

Critical bug disclosure

Few days ago the guy who found a vulnerability in Blockchain.Info and picked the secret phrase of Nxt genesis account found a security flaw in NRS cryptographic algorithm. The flaw allowed to replay transactions that would lead to double-triple-etc amounts sent. In fact, by finding this flaw he conducted an audit of Crypto class and won the bounty that we collected specially for such a case.

I can't explain details of the flaw, coz it's out of my area of expertise. U can contact him directly via nextcoin.org forum.

The flaw has been fixed and all who updated to 0.6.0+ are safe now. Users of older versions are safe too as long as they are connected to nodes with 0.6.0+.

PS: The community should collect 10 BTC again coz we still need to do the audit of the code.

so next is broken al ready and they have to paid ransom to a guy for stopping attacks. Why r people still buying this broken piece of shitcoin

and main dev don't know nothing about if you have to ask the attacker self.

0.000003

We're still waiting for you dumping. Wink

Emule

full member

Activity: 168

Merit: 100

Quote from: ?? on ??

Quote from: msin on February 07, 2014, 12:42:08 PM

Let's get this guy on board, Klee is in charge of the infrastructure team, so perhaps Klee can get him on board and a good chunk of Nxt from unclaimed.

+1

big panic he can earn more by exploiting the flaw and sell it.

Emule

full member

Activity: 168

Merit: 100

Quote from: Come-from-Beyond on February 07, 2014, 10:59:26 AM

Critical bug disclosure

Few days ago the guy who found a vulnerability in Blockchain.Info and picked the secret phrase of Nxt genesis account found a security flaw in NRS cryptographic algorithm. The flaw allowed to replay transactions that would lead to double-triple-etc amounts sent. In fact, by finding this flaw he conducted an audit of Crypto class and won the bounty that we collected specially for such a case.

I can't explain details of the flaw, coz it's out of my area of expertise. U can contact him directly via nextcoin.org forum.

The flaw has been fixed and all who updated to 0.6.0+ are safe now. Users of older versions are safe too as long as they are connected to nodes with 0.6.0+.

PS: The community should collect 10 BTC again coz we still need to do the audit of the code.

so next is broken al ready and they have to paid ransom to a guy for stopping attacks. Why r people still buying this broken piece of shitcoin

and main dev don't know nothing about if you have to ask the attacker self.

0.000003

ChuckOne

sr. member

Activity: 364

Merit: 250

☕ NXT-4BTE-8Y4K-CDS2-6TB82

Quote from: Anon136 on February 07, 2014, 12:41:53 PM

you know guys. we could cut out the dollar by tying our main token that we trade with to something extremely liquid but lacking other properties of money. the nxt token representation of the object will give it its strong money characteristics and the high liquidity of the item its tied to could give a stable and recognizable price.

so just as an offhand example, the basic pricing could be done by having the main medium of exchange be a token that represents 1 egg. say i am an egg farmer, i issue 1 million grade a egg colored tokens. the nxt/egg cross becomes the deepest and most liquid token in the market and so then nxt becomes priced in eggs. if you want to know what the value of a nxt is in dollars then you go to the supermarket and check out the price of eggs and just do the conversion. if you want eggs than you just trade 1 token for 1 egg to the egg farmer.

eggs probably bag example. ill try to think of something better.

Don't see how this should convert to real egg prices? If we cut out the dollar and the supermarket only accepts dollars then there's no link between real eggs and nxt eggs.

Supermarket should accept NXTs then we get the price real.

mezzovide

member

Activity: 101

Merit: 10

Quote from: xibeijan on February 07, 2014, 12:23:51 PM

Quote from: greyw00lf on February 07, 2014, 12:17:10 PM

Quote from: achimsmile on February 07, 2014, 12:06:53 PM

Below is the message doctorevil sent to inform captain picard, cfb, and opticalc!

We must get this guy to join us as dev!

+1

msin

legendary

Activity: 1470

Merit: 1004

Quote from: Jesse James on February 07, 2014, 11:48:16 AM

Quote from: Come-from-Beyond on February 07, 2014, 10:59:26 AM

Critical bug disclosure

Few days ago the guy who found a vulnerability in Blockchain.Info and picked the secret phrase of Nxt genesis account found a security flaw in NRS cryptographic algorithm.

...

I can't explain details of the flaw, coz it's out of my area of expertise. U can contact him directly via nextcoin.org forum.

I'm the guy. I just created a thread providing more technical details https://nextcoin.org/index.php/topic,3884.0.html and to answer questions. I don't really check this forum/thread so posting there is the best way to reach me.

Let's get this guy on board, Klee is in charge of the infrastructure team, so perhaps Klee can get him on board and a good chunk of Nxt from unclaimed.

Anon136

legendary

Activity: 1722

Merit: 1217

you know guys. we could cut out the dollar by tying our main token that we trade with to something extremely liquid but lacking other properties of money. the nxt token representation of the object will give it its strong money characteristics and the high liquidity of the item its tied to could give a stable and recognizable price.

so just as an offhand example, the basic pricing could be done by having the main medium of exchange be a token that represents 1 egg. say i am an egg farmer, i issue 1 million grade a egg colored tokens. the nxt/egg cross becomes the deepest and most liquid token in the market and so then nxt becomes priced in eggs. if you want to know what the value of a nxt is in dollars then you go to the supermarket and check out the price of eggs and just do the conversion. if you want eggs than you just trade 1 token for 1 egg to the egg farmer.

eggs probably bag example. ill try to think of something better.

ChuckOne

sr. member

Activity: 364

Merit: 250

☕ NXT-4BTE-8Y4K-CDS2-6TB82

Quote from: xibeijan on February 07, 2014, 12:34:43 PM

Quote from: ?? on ??

NXT Vote on Transaction Fees seems no longer discussed. So... my final tally:

Fee Amount

Votes

0.000001	1
0.001	2
0.01	10
0.05	1
0.055	2
0.1	37
0.25	2
0.1	7

Mean: 0.184870983870968
Median: 0.1
Mode: 0.1

Google Doc:
https://docs.google.com/spreadsheet/ccc?key=0Akjrt0LTBXgcdFFkSGMwXzd4Q2NPU21yU2NOYWVldlE&usp=sharing

This marks the end of my tally. If someone else wants to continue, I can give permissions on the google doc. Send me a PM.

Cheers!

I didn't see the announcement to vote.

What's you opinion on that?

timmyd

hero member

Activity: 714

Merit: 500

Quote from: xibeijan on February 07, 2014, 06:36:45 AM

Quote from: ?? on ??

Quote from: xibeijan on February 07, 2014, 06:22:42 AM

Why we need crypto-currency

http://www.bbc.co.uk/news/business-25861717

thats bullshit.. your money so you can withdraw what ever you want! id have a shit attack if my bank said i couldnt withdraw my own money in person in the bank.. id understand a few hundred thou or a million but not just a couple thou... there all goin buyin bitcoin from zipzap lol

Yeah, it's scary. If a well capitalised bank like HSBC is not letting customers withdrawal 7,000, then the finance world is in a really bad state!

That's not a conspiracy theorist article either--- it's BBC!

Unless it states in the banks terms and conditions that "on deposit of funds into the bank. The bank then own your deposit , they cannot stop you withdrawing your money for any purpose"
Its basically theft. I suggest that anyone who trys to withdraw their own money from a bank and they refuse to call the police. Its theft they cannot hold your money hostage. Unless like i said the deposit becomes property of the bank. And if it does say this in any banks terms then it must be hidden and i reckon people would like to know abou this.

ChuckOne

sr. member

Activity: 364

Merit: 250

☕ NXT-4BTE-8Y4K-CDS2-6TB82

Quote from: ?? on ??

NXT Vote on Transaction Fees seems no longer discussed. So... my final tally:

Fee Amount

Votes

0.000001	1
0.001	2
0.01	10
0.05	1
0.055	2
0.1	37
0.25	2
0.1	7

Mean: 0.184870983870968
Median: 0.1
Mode: 0.1

Should be:

1.0

7

FrictionlessCoin

legendary

Activity: 868

Merit: 1000

Cryptotalk.org - Get paid for every post!

Quote from: achimsmile on February 07, 2014, 12:06:53 PM

Below is the message doctorevil sent to inform captain picard, cfb, and opticalc!

We must get this guy to join us as dev!

Quote from: lucky on January 09, 2011, 04:58:56 PM

The disclosure CfB recently announced on the BCT thread might leave some with questions regarding the exact details. Here's what I sent CfB, Jean-Luc, and OpticalC earlier:

Quote from: doctorevil on February 05, 2014, 11:17:36 AM

-Gentlemen-

All versions of NXT are currently vulnerable to a transaction replay attack.

I've tested this exploit successfully (TXs 16383865633576457223 and 6120913904145250080).

This message has only been sent to you 3 (Jean-Luc, opticalc and CfB); however, I plan to eventually make a public disclosure.

Specifics:

Anyone on the network can create 15 replicas of a transaction that verify OK but which have distinct transaction ids. This has to do with a phenomenon called signature malleability. Given a valid signature X₀, anyone (not just the original signer) can create 15 additional distinct signatures X₁, X₂ ... X₁₅ which all verify correctly.

The only circumstances in which a transaction can not be replayed are if:

(1) the sender's balance is too low or
(2) the transaction deadline has expired

Example exploit scenario:

BTER currently has a 40M+ NXT wallet it sends withdrawals from. If I was evil, I could transfer 100k NXT back and forth between myself and BTER. Lets say I do this 10 times. A few hours later I could create 15 replays of each withdrawal transaction, netting 1.5M NXT. If I was super evil I could send the replays immediately after each withdrawal, redepositing the new NXT and growing the heist exponentially. One could drain their entire 40M wallet in 3 round trips starting with just 12500 NXT. Eviler still, one could also replay recent transactions flowing into BTER from depositors in order to steal their funds as well, swelling the total catch beyond 40M.

Several possible fixes come to mind:

(1) define a canonical signature representation (bitcoin's approach)
(2) exclude the signature field when calculating the transaction id (probably too sweeping a change at this point)
(3) explicitly check for replays in processTransactions (a bit of a kludge)

The math:

The output of Curve25519.sign is v. This value essentially acts like an element in a finite field who's order is the same as the curve group order (2²⁵²+2¹²⁴). So for any v, you can add 2²⁵²+2¹²⁴ and arrive at a value that is equivalent as far as the underlying field math is concerned. NXT encodes v using 256 bits (32 bytes). Since 2²⁵⁶ is significantly larger than the group order, there are ~16 distinct 256-bit encodings of each field element. Because everyone knows the group order and v is part of the signature, anyone can generate the other encodings to perform this attack.

In closing, I just want to say that it hurts my evil heart not to exploit this.

-Dr. Evil-

This was quickly followed up with some back and forth with CfB where I provided him actual code for the exploit (which I'll elide here for obvious reasons) and a discussion of the plan for how to rollout a fix (which they implemented within hours of initially communicating with them).

He also threw me 10 BTC, which I didn't really expect but greatly appreciated. I got all of jack shit (other than a warm fuzzy) when I privately revealed to blockchain.info a RNG bug that had already lead to multiple documented thefts.

I'm happy to answer in this thread any remaining technical questions the community might have about the nature of the flaw.

quoted.

mkmen

full member

Activity: 157

Merit: 100

Quote from: Jesse James on February 07, 2014, 11:48:16 AM

Quote from: Come-from-Beyond on February 07, 2014, 10:59:26 AM

Critical bug disclosure

Few days ago the guy who found a vulnerability in Blockchain.Info and picked the secret phrase of Nxt genesis account found a security flaw in NRS cryptographic algorithm.

...

I can't explain details of the flaw, coz it's out of my area of expertise. U can contact him directly via nextcoin.org forum.

I'm the guy. I just created a thread providing more technical details https://nextcoin.org/index.php/topic,3884.0.html and to answer questions. I don't really check this forum/thread so posting there is the best way to reach me.

Huge respect to you. I'm gonna send some NXT to your "ransom" account once I'm comfortable running the client. Thank you for this.

xibeijan

legendary

Activity: 1232

Merit: 1001

Quote from: ?? on ??

NXT Vote on Transaction Fees seems no longer discussed. So... my final tally:

Fee Amount

Votes

0.000001	1
0.001	2
0.01	10
0.05	1
0.055	2
0.1	37
0.25	2
0.1	7

Mean: 0.184870983870968
Median: 0.1
Mode: 0.1

Google Doc:
https://docs.google.com/spreadsheet/ccc?key=0Akjrt0LTBXgcdFFkSGMwXzd4Q2NPU21yU2NOYWVldlE&usp=sharing

This marks the end of my tally. If someone else wants to continue, I can give permissions on the google doc. Send me a PM.

Cheers!

I didn't see the announcement to vote.

Anon136

legendary

Activity: 1722

Merit: 1217

Quote from: brooklynbtc on February 07, 2014, 12:29:33 PM

Quote from: Anon136 on February 07, 2014, 12:24:43 PM

Quote from: BaiMangal on February 07, 2014, 12:20:49 PM

Quote from: Anon136 on February 07, 2014, 12:02:27 PM

than ill just do silver bullion only.

what does this mean? sry for the silly question but if its real silver plate does it not have TAX on top of it?

you don't have to deal with fincen compliance if you are just trading digital tokens for silver and silver for digital tokens. you arnt considered a money services business unless you handle fiat in some way.

and I assume you can trade crypto to crypto as well.

that is correct

brooklynbtc

sr. member

Activity: 336

Merit: 250

AKA jefdiesel

Quote from: cryptolawyer on February 07, 2014, 12:27:46 PM

Quote from: brooklynbtc on February 07, 2014, 11:59:07 AM

Quote from: Anon136 on February 07, 2014, 11:48:55 AM

Quote from: Come-from-Beyond on February 07, 2014, 11:24:27 AM

Quote from: Anon136 on February 07, 2014, 11:18:04 AM

rofl. i completely missed that thread where i was mentioned like a dozen times

U should monetize ur reputation. If u were a fiat gateway operator for Asset Exchange, u would help the community a lot. I would accept dollars issued by u without any doubt. Think of such a business plz...

I was planning on being the silver bullion gateway but I could also do fiat.

Does anyone have any thoughts on US based fiat exchange? Seems you have all the FINCEN registration to go through.
What does localbitcoins do? Fly under the radar? I bought my first Btc in person from localbitcoins, from a daytrader literally on wall street.

I will gladly make myself available as a New York based fiat exchange, but trying to sort the legality.

Stop by the NY Bitcoin Center at 40 Broad on Monday night and throw some NXT into the mix. I was there last week and Doge was being traded alongside BTC.

If you do, I'll know who you are, and come over and introduce myself.

Hey CL

What's the usual method of trading over there? fees?
I would imagine offering NXT is a little harder, what with phone apps and wallets. Def need a laptop with you I assume?

Passion_ltc

hero member

Activity: 714

Merit: 500

Crypti Community Manager

Quote from: ?? on ??

NXT Vote on Transaction Fees seems no longer discussed. So... my final tally:

Fee Amount

Votes

0.000001	1
0.001	2
0.01	10
0.05	1
0.055	2
0.1	37
0.25	2
0.1	7

Mean: 0.184870983870968
Median: 0.1
Mode: 0.1

https://i.imgur.com/jQzwKMG.png

Google Doc:
https://docs.google.com/spreadsheet/ccc?key=0Akjrt0LTBXgcdFFkSGMwXzd4Q2NPU21yU2NOYWVldlE&usp=sharing

This marks the end of my tally. If someone else wants to continue, I can give permissions on the google doc. Send me a PM.

Cheers!

I would say we finish this and implement the 0.1 NXT fee.

stereotype

legendary

Activity: 1554

Merit: 1000

Quote from: Anon136 on February 07, 2014, 12:24:43 PM

Quote from: BaiMangal on February 07, 2014, 12:20:49 PM

Quote from: Anon136 on February 07, 2014, 12:02:27 PM

than ill just do silver bullion only.

what does this mean? sry for the silly question but if its real silver plate does it not have TAX on top of it?

you don't have to deal with fincen compliance if you are just trading digital tokens for silver and silver for digital tokens. you arnt considered a money services business unless you handle fiat in some way.

Is that what Mike Caldwell would say?

Topic: NXT :: descendant of Bitcoin - Updated Information - page 1018. (Read 2761645 times)